PT-2025-28293 · Sap · Sap Netweaver Application Server Java

Published 2025-07-07 · Updated 2025-07-08 · CVE-2025-42978

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server Java (affected versions not specified)

Description: The issue concerns a component in SAP NetWeaver Application Server Java that handles outbound TLS connections. This component does not properly verify the hostname of the remote TLS server against the wildcard hostname in the server's certificate. As a result, it may establish a connection to a potentially malicious server, leading to information disclosure. However, this issue does not affect the integrity or availability of the system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-940

Related Identifiers

BDU:2025-10649

CVE-2025-42978

Affected Products

Sap Netweaver Application Server Java

References · 6

• https://bdu.fstec.ru/vul/2025-10649 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-42978 · Security Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html · Note
• https://twitter.com/CVEnew/status/1942418286395740285 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://me.sap.com/notes/3557179 · Note